From 84573fe50b7c064a4bd69b51ce800e3658f8ef5c Mon Sep 17 00:00:00 2001 From: Damien Bouvy Date: Tue, 26 Jan 2016 11:42:36 +0100 Subject: [PATCH] [FIX] website_sale: do not force send the quotation in case of payment error This could allow a malicious flow that made the quotation available via the website_quote module; allowing you to sign and confirm the order without actually paying it. --- addons/website_sale/models/payment.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/website_sale/models/payment.py b/addons/website_sale/models/payment.py index 563a8597a20..f632292e8f7 100644 --- a/addons/website_sale/models/payment.py +++ b/addons/website_sale/models/payment.py @@ -24,7 +24,7 @@ class PaymentTransaction(orm.Model): tx = getattr(self, tx_find_method_name)(cr, uid, data, context=context) if tx and tx.state == 'done' and tx.acquirer_id.auto_confirm == 'at_pay_confirm' and tx.sale_order_id and tx.sale_order_id.state in ['draft', 'sent']: self.pool['sale.order'].action_confirm(cr, SUPERUSER_ID, [tx.sale_order_id.id], context=dict(context, send_email=True)) - elif tx and tx.state not in ['cancel'] and tx.sale_order_id and tx.sale_order_id.state in ['draft']: + elif tx and tx.state not in ['cancel', 'error'] and tx.sale_order_id and tx.sale_order_id.state in ['draft']: self.pool['sale.order'].force_quotation_send(cr, SUPERUSER_ID, [tx.sale_order_id.id], context=context) return res